Supply Chain Security in Kubernetes
summary
Shows concrete wins: replacing a 134 MB Debian nginx image with a 22 MB alpine image and a 13-package Chainguard image cuts reported vulnerabilities from many entries to zero in the demo. Uses Sigstore/cosign keyless signing (Fulcio + transparency log) to attach signatures and SBOMs, then enforces them with Kyverno verifies signatures at admission so unsigned images are denied. Recommends automated frequent updates, smaller base images (apko/melange for distro-less builds), and running scanners like grype while trimming noise by minimizing packages.
AI-written summary · about
chapters (6)
- 0:00Start
- 7:20Reduce Dependencies
- 7:48Know What's Running In Your Cluster
- 10:42Minimal Images
- 13:43Sign Your Images
- 26:57Sigstore Keyless Signing Flow
related talks
28mBuilding Images for the Secure Supply Chain
34mMake the Secure Kubernetes Supply Chain Work for You
33mBuilding Images For The Secure Supply Chain
36mKubernetes Supply Chain Security: The Software Factory
36mHow to Prevent Your Kubernetes Cluster From Being Hacked — Nico Meisenzahl and Philip Welz
35mEnforcing a Secure Supply Chain on Kubernetes
28mKubernetes Security Low-Hanging Fruit
36mEnforcing a Secure Supply Chain on Kubernetes